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MEMORANDUM FOR PRIVACY ACT OVERSIGHT OFFICIALS ae 


Subject: Application of Subsection (m) of the Privacy Act 


Attached for your information it a recent legal opinion from 
the OMB Office of General Counsel interpreting the applic- 
ability of subsection (m) of the Privacy Act to certain 
research and other contracts. 


We request that you review your agency's policies and 
procedures for handling personal records under the contrel 
of contractors to assure that these records systems are 
maintained in accordance with this interpretation of the 
Privacy Act. 


If there are any questions, plezse contact the Informaticr 
Systems Policy Division at 395-2785. 


Sincerely, 

Aber 4 Ahee se. 
Walter W. Haase 
Deputy Associate Director 


for Information Systems Policy 


Attachment 
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November 30, 1979 


MEMORANDUM FOR: Mary M. Goggin, Chief 
Administrative Law Branch, HEW 


FROM: William M. Nichole 


SUBJECT: Application of Subsection (m) of the 
Privacy Act 


This is in response to your request for our comments on the 
HEW interpretation of the application of subsection (m) of 
the Privacy Act (5 U.S.C. 552a) to certain research and 
other (unspecified) contracts. Subsection (m) provides 
that: 


"When an agency provides by a contract for the 
Operation by or on behalf of tha agency of a 
system of records to accomplish an agency function, 
the agency shell, consistent with its Authority, 
Cause the requirements of this section to be 
applied to such system. For purposes of subsection 
(41) of this section any such contractor and any 
employee of such contractor, if such contract 

is agreed to on or after the effective date of 
this section, shall be considered to be an 
employee of an aqancy.” 


The HEW position, as stated in the memorandum entitled 
"Application of Privacy Act to HEW Contracts,” from William 
H. Taft, General Counsel, to John Ottina, Assistant Secretary 
fox Administration and Managemant, dated May 17, 1976, (so- 
called "Taft memorandum"), is that: 

". « ethe requirements of the Privacy Act of 
1974 are not applicable to HEW research and 
other contrects which call for the contractor 
merely to furnish to the HEW contracting 
agency statistical or other reports, even 
though it {1s necessary for the contractor 
to establieh a system of records to perform 
the contract. 
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Where the contracting agency is interested 
only in obtaining the results of the research 
or other work performed under the contract 
(generally in the forn of a report) and does 
not require the contractor to furnish it 
individually identifiable records from the 
system established by the contractor, it 
cannot be said that the system is one which 
‘but for’ the contract, the agency would 
have established." (Taft memo, p. 2). 


We disagree with this interpretation. The application of 
Subsection (m) is not. dependent upen the disclosure of 
individually identitiable records by the contractor to the 
agency. Nothing in the statute, its legislative history, or 
the OMB Privacy Act implementation Guidelines (40 Fed. Rea 
No. 132, Wedneseday, July 9, 1975, p- 28948) supports suc 

a reading of the law. 


The contract puts the personally identifiable information 
into the hands of the contractor. The data would have been 
collected and maintained by the agency if the work performeé 
under contract had remained in-house. The contractor is 
performing an agency function and the Act applies. 


Approved For Release 2002/07/03 : CIA-RDP83T00573R000200240018-8 


Approved ser Release 2002/07/03 : CIA-RDP83T08873R000200240018-8 


ADMINISTRATION OF ‘THE PRIVACY ACT OF 1974 


Office of Management and Budget 
Tnformation Systems Policy Division 
January 4, 1980 
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bOREWORD 


The Privacy Act of 1974 (Public Law 9'-579) was enacted to 
ensure an appropriate balance between the Federal Government's 
need for information about its citizens and the individual's 
right to privacy. The Act seeks to achieve this objective 

by establishing procedures to regulate the collection, mainte- 
nance, use and dissemination of personal information by 
Federal agencies. The Act establishes a system of checks and 
balances to ensure the effective operjition of these procedures. 
These checks and balances include provisions for the exercise 
of individual rights, public scrutiny of agency recordkeeping 
practices, Office of Management and Budget and congressional 
oversight of agency activities, and both civil and criminal 
sanctions. 


This document summarizes OMB activitics to implement the Act 
and outlines the internal processes established by OMB to 
exercise its oversight responsibilitics under the Act. This 
document is being provided to Federal agencies and the public 
to foster a greater understanding of how the administrative 
processes work, and to provide greater opportunities for the 
public to participate in these processes by understanding how 
they work and by making suggestions for their improvement. 
Comments and suggestions are welcome. 


Walter W. Haase 
Deputy Associate Director 
for Information Systems Policy 
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BASIC PROVISIONS OF THE ACT 


The Privacy Act of 1974 recognizes a fundamental right of 
individual privacy, and sets forth a system of checks and 
balances to regulate the collection, maintenance, use and 
dissemination of personal information by the Federal 
Government. The provisions of the Act are designed to 
achieve a balance between the Government's need for infor- 
mation and the individual's right to. privacy. The Act: 


1. Establishes certvin rights of individuals. Individuals 
must be permitted to: 


° Know the authority under which information about 
them is collected, the purpose for which it is 
collected, how it will be used, and the effect on 
them of not providing information. 


° Review agency records about them and to review 
agency records on any disclosure of this informa- 
tion. 


° Request that personal information which they 
believe to be incorrect be amended, corrected or 
removed. 


© Appeal agency denials of PEGeees : for amendment 
Or correction. 


° Sue an agency in U.S. District Court for certain 
violations of the Act. 


2. Makes the heads of Federal agencies responsible and 
accountable | for complying ° with. operational requirements 
established “by the Act. Agency heads must: 


° Appropriately balance the Government's need for 
information with an individual's right to privacy. 


° Comply with standards and procedural provisions 
of the Act pertaining to the collection, mainte- 
nance, use and dissemination of personal informa- 
tion. 


° Collect and maintain only that personal infor- 
mation which is relevant and necessary to carry 
out agency functions authorized by law or executive 
order. 


° Ensure that individuals are qiven a way to exercise 
their riahts under the Act. 
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° Open their agenrcie es' personal recordkeeping practices 
to public serntiny. 


° Safeguard personal data and prevent its unauthorized 
disclosure. 


3. Provides for enforcement of the provisions of the Act 


through a number of checks, ‘balances and sanctions. 


The Act, which is based on the concept of agency 
accountability, provides for enforcement through: 


° The exercise of rights by individuals. 


° Subjecting the aqency's personal recordkeeping 
practices to public scrutiny. 


° Civil sanctions which can be exercised against the 
Government for certain violations. 


° Criminal sanctions which can be exercised against 
any Federal employeo tor certain violations and 
against members of the public at large for certain 
violations. 


4. Makes OMB responsinle for overseeing administration _ 


‘of the Act. Specifically, OMB must: 


° Provide guidelines and regulations for use by 
the agencies. 


° Provide continuing assistance to aqencies. 


° Oversee the procedural mechanisms established by 
the Act. 


iMPLEMENTATION APPROACH 


OMB's approach to impiement.ing and overseeing administra- 
tion of the Act has been directed toward: 


1. Ensuring that the heads of agencies and Federal 
employees understand their obligations and responsi- 
bilities under the Act. 


2. Developing and issuing guidelines and otherwise 
assisting agencies in their implementation of the 
provisions ot the Act. 


3. Allowing for agency discretion in the manner by which 
they fulfill their responsibilities under the Act, by 
minimizing issuance of regulations and detailed pro- 


cedures by OMB 
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4. Closely monitoring aqencies' administration of the Act 
calling their attention to apparent violations, and 
requesting them to take appropriate corrective action. 


5. Using existing management control processes and the 
people administering those processes wherever possible 
to assist in administering the requirements of the Act. 


6. Establishing a system of chacks and balances to ensure 
effective operation and enforcement of the Act. 


Consistent with this approach, OMB has delegated responsi- 
bility for developing privacy policy guidance (within the 
framework of OMB policy and oversight) to a number of other 
central policy agencies. For example: 

° The Director of the Offiee of Persennel Management 
(formerly the Civil Service Commission) was made 
responsible for revising Federal personnel manage- 
ment regulations to reflect privacy considerations 
~- thereby makina all agency personnel officers 
responsible for assuring compliance with Federal 


° The Administrator of the General Services Adminis-~ 
tration was; made responsible for revising Federal 
records storage and archivina regulations to in- 
corporate privacy considerations -- thereby making 
those considerations part of the job of every 
records manager. 


Similar assiqnments of responsibility were made in 
other functional areas such as procurement and 
clearance of reports under the Federal Reports Act. 
Each assignment was made to take advantage of exist- 
ing functional processes and incorporate privacy 
considerations into the day-to-day operations of 
existing organizations. 


° Many of the OMB oversight functions have been 
incorporated in the existing budget and legislative 
review processes. 


This approach: 


° Instills privacy awareness and consciousness in 
a larger number of people than would be possible 
by other means. 


° Takes advantage of the functional expertise which 
exists in various central policy agencies. 
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° Makes privacy consideration a responsibility of 
many people -- all of whom are subject. to criminal 
Sanctions for certain improper actions, 


° Avoids excessive costs by using existing administra- 
tive processes and personnel. 


POLICY GUIDANCE 


A wide range of policy, guidelines and interpretations of 
the requirements of the Act has heen developed and issued 
to guide agencies in their administration of the Act. The 
most significant of these are listed below. 


° 


Presidential Policy Direction 


President Ford's January 1975 press: release issued upon 
signing of the Act. 


President Ford's September 29, 197), Statement issued on 
the effective date of the Act stressed the importance 
of the Act and his support for it. 


President Ford's Julv 20, 1976 letters to the Speaker 

of the House and the President of the Senate transmitted 
the First Annual Report to Congress on executive branch 
activities to comply with the Privacy Act. 


President Carter's June 30, 1977 letters to the Speaker 

of the House and the Prasident of the Senate transmitted 
the Second Annual Report to the Congress on executive 
branch activities to comply with the Privacy Act. The 
President endorsed the efforts of OMB to reduce Government 
intrusion into the private lives of Americans and urged 
the Congress to consider the Federal experience in de- 
liberations on future privacy legislation. : 


President Carter's July 20, 1978 letters to the Speaker 
of the House and the President of the Senate transmitted 
the Third Annual Report to Congress on executive branch 
activities to comply with the Privacy Act. The President 
indicated that personal privacy was an important priority 
of his Administration. 


President Carter's Auqust 31, 1978 memorandum to the heads 
of executive departments ard agencles requested agency 
heads to initiate further efforts to reduce the amount of 
personal information collected by their agencies, avoid 
the unwarranted disclosure of this information and improve 
their internal manaqement of personal data svstems. 
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° President Carter's April 2, 1979 messaqe to Congress 
announced a wide range of initiatives to protect 
individual privacy. To implement these policies the 
President proposed four new bills providing privacy 
protection for medical records, federally funded re- 
search records, tinancial records, and news media notes 
and materials. ‘The President asked that new procedures 
be set for Federal agqencies' administrative actions and 
called for action by State ané local governments and the 
private sector to voluntarily adopt recordkeeping 
practices which would provide an appropriate level of 
protection for individual privacy. 


° President Carter's August 16, 1979 letters to the 
Speaker of the House and the President of the Senate 
transmitted the Fourth Annual Report to Congress on 
executive branch activities to comply with the Privacy 
Act. The President urged the Congress to carefully 
consider the Administration's record of progress in 
implementing the Act as it considered the Administra- 
tion's legislative proposals on individual privacy. 


OMB Policy Direction 


w&%, ° OMB Circular Ne. A-i0% dated July 1, 1975, outlines 
agency responsibilitios for imolementing and administer- 
ing the Act. 


- T.M. No. i, dated September 30, 1975, sets forth 
agency requirements for proposals to establish or 
alter personal data systems, 


~ T.M. No. 2, dated March 25, 1976, and T.M. No. 4, 
dated January 31, 1978, set forth agency reporting 
requirements for the annual report to Congress. 


- T.M. No. 3, dated May 17, 1976, sets forth revised 
guidance on agency proposals to establish or alter 
systems, establishes a provision for waiving the 60 
day advance notice period, and provides for public 
review of the new svstem proposals. 


~ T.M. No. 5, dated August 3, ‘1978, transfers to OMB the 
responsibilities for issuing policies regarding Govern-- 
ment telecommunications relative to the Privacy Act. 


\e ° Guidelines to agencies for implementing the Privacy Act. 
issued by OMB as a supplement to OMB Circular No. A-108 
on July 1, 1975 and amended on November 21, 1975. 


° Director Lance's memorandum ta agency heads, dated March 
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the reduction of personal recordkeeping in the course of 
efforts to reduce public reporting burden. This 

letter was followed by individual letters to heads of 

15 major recordkeeping agencies requesting specific plans 
for reducing personal recordkeeping by their agencies. 


Director Lance's August 3, 1977 memorandum to agency 
heads, transmitted the President's Second Annual Report 
to the Congress and requested further efforts at 
reducing personal recordkeeping. 


OMB Circular No. A-71, IT.M. No. 1, “Security of Federal 
Automated Information Systems," was issued on July 27, 

1978 to ensure protection of personal, proprietary and 

other sensitive data in Government computers. 


Director McIntyre's March 30, 1979 memorandum to agency 
heads provided guidelines to agencies for computer 
matching of personal records. 


Director McIntyre's Mav 22, 1979 memorandum to agency 
heads summarized President Carter's privacy initiatives 
and required each agency head to designate an office 

or official to bear oversight responsibility for the 
administration of the P-ivacy Act within that agency. 


Mr. Walter W. Haase's January 2, 1980 memorandum to 
agency Privacy Act oversight officials transmitting 
an OMB legal opinion regarding the application of 
Privacy Act requirements for publishing systems of 
records to research and other contractors who maintain 
agency records containing personal data. 


Office of Personnel Management Policy Direction 


OMB Circular No. A-108 assigned the Office of Personnel 
Management responsibility for revising civilian personnel 
recordkeeping policies to conform with the Act and to 
train agency personnel in the requirements of the Act. 
Policy guidance issued by OPM includes: 


Qo 


Revision of Federal Personnel Manual, Chapters 293 and 
297, September 30, 1975. ; 


Notices describing the operation of four government-wide 
systems of personnel records which are maintained for 
OPM by operating agencies published August 27, 1975 and 
May 29, 1979. 


Regulations foc the concuct of Federal service suitabil- 
ity investigations, FPM Chapter 736, Dacamber 4, 1975. 
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° Federal Personnel Manual letter 7327 “Personnel Security 
Program for Positions Associated with Federal Computer 
Systems,” November 14, 1978. 

General Services Administration Policy Guidance 

The Act assiqned responsibility to the GSA for coordinatirg 

agency publication of Privacy Act notices and for preparirg 

the Annual Compilation of rules and notices. OMB Circular 

No. A-108 assigned GSA responsibility for the issuance of 

policies pertaining to privacy consideration in records 

management and storage, in interagency data collection 
forms, and in the procurement of comput er/communications 

Systems. Policy quidance issued by GSA includes: 


° "Guidelines for Records Management Systems to Implement 
the Privacy Act," issued by the National Archives and 
Records Service, August 1975. 


° GSA Bulletin FPMR B-57, dated August 22, 1975, regarding 
agency records stored in Federal records centers. 


° FPMR Temp. Reg. [-43, "ADP and Telecommunications Check- 
list," dated Octisber 17, 1975, establishing a checklist 
of privacy and other requirements to be considered in 
agency procurenent of computer and communications system::. 


° FPR Amendment 155, dated September 23, 1975, establishing 
rules and procedures for Government contracts involving 
personal recordkeeping. 


° FPMR 101-35.17, dated June L6, 1978, "Privacy and Data 
Security for ADP and Telecommunications Systems." 


° Publication requirements for the Privacy Act of 1974, 
dated June 17, 1975, updated April 8, 1977 and June 1, 
1978. 


Department of Commerce Policy Guidance 


OMB Circular No. A-108 assigned the National Bureau of 
Standards (NBS) responsibility for ceveloping and issuing 
standards and quidelines on computer security. Guidance 
issued includes: 


° FIPS Pub 41 “Computer Security Guidelines for Imple- 
menting the Privacy Act of 1978," dated May 30,.1975. 


° "Index of Automated System Design Requirements," dated 
October 1975. 
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° NBS Technical Note 906, “A Methodology for Evaluation 
of Alternative Technical and Information Management 
Approaches to Privacy Requirements." 


° Special Publication 500-10, "A Data Base Management 
Approach to Privacy Act Compliance." 


Department of Justice Policy Guidance 


The Department of Justice has issued two policy letters 
regarding the Privacy Act: 


° Establishment. of "routine uses" for the referral of 
information for law enforcement and Federal employment 
purposes, dated June 5, 1975. 


° Disclosure of Payroll Information to State/local Taxing 
Jurisdiction in the Absence of: Withholding Agreements, 
dated March 23, 1976. 


Privacy Act Litigation 


The Act and all the policies, procedures and regulations 
which have been established to implement the Act are 
,designed to seek an appropriate balance between Government 
needs for personai information and an individual's right 
to privacy. This balancing of conflicting interests will 
inevitably result in differences of judgment between 
individuals and the Government which can only be resolved 
in the courts. This case law will, over time, provide 
additional interpretive guidance. During 1976 and 1977, 
210 suits were filed. At the end of 1978, 101 suits 
remained unresolved. 


Since the Privacy Act and the Freedom of Information Act 
(FOIA) are both parts of the same statute (5 U.S.C. 551 et. 
seq.) and deal with access to Government records, many 
lawsuits are brought under both Acts. Thus, FOIA and 
Privacy Act case laws are related and familiarity with both 
is helpful to an understanding of either. 


INVENTORY OF FEDERAL PERSONAL PATA SYSTEMS 


A computerized inventory of all Federal: personal data 
systems subject to the Act is maintained by OMB to: 


° Describe the size, nature and purpose of personal infor- 
mation systems maintained by Federal agencies. 
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° Observe and analyze agency use of the exemption provi- 
sions, use of computers for processing personal data, 
and a wide variety of other trends as a basis for 
formulating furt-her policy by OMB. 


° Measure agency accomplishments in reducing {or curtail- 
ing growth in) the number and type of personal records 
which they maintain. 


The 1978 inventory contained description of 5,881 personal 
data systems maintained by Federal agencies. It is 
periodically updated based on information contained in 
agency reports on new and altered systems submitted to OMB 
and information contained in agency systems notices 
published in the Federal Register. 


Annually, the agencies are asked to validate and update 
the inventory as a part of the information which they 
submit for the Prosident's Annual Report to Congress. 


PRESIDENT'S ANNUAL REPORT TO CONGRESS 


The Privacy Act requires the President to report annually 
to the Speaker of the House and’ President of the Senate on 
executive branch activities to comply with the Privacy Act. 
OMB prepares the vYresident's Report based on agency reports. 


Consistent with the policy of agency accountability for 
complying with the requirements of the Act, agencies are 
required to provide annual reports on their administratisn 
of the Act to OMB. The requirements plated on agencies Sy 
OMB stress reporting of: 


° Agency accomplishments and plans for protecting individual 
privacy and reducing the magnitude of persona’ records © 
Maintained by the agency. 


. Agency actions to ensure that: individuals are allowed ta 
exercise their rights, to open their recordkeeping 
practices to public scrutiny, and to administer the 
exemption provision. 


° Agency recommendations on actions that should be taken to 
address major problems that have arisen in their adminis- 
tration of the provisions of the Act -- through changes in 
Administration policies or by’ seeking legislative changes 
to the Act. 


The agency reports are analyzed by OMB and used to prepara 
the President's Annual Report to Congress. To date, four 


annual reports have been submitted to Cohgress, one by 
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REVIEW OF AGENCY RULES AND NOTICES 


The Act requires agencies to publish rules (in accordance 
with the Administrative Procedure Act) to advise the public 
of procedures for excercising their rights under the Act and 
agency justification for invoking certain exemptions per- 
mitted by the Act. it also requires agencies to annually 
publish notices describing each of their personal data 
systems subject to the Act in order to provide for public 
review of their recordkecping practices. 


The Act required agencies to publish these rules and initia! 
notices by September 27, 1975. OMB convened a task force 0: 
agency personnel to assist agencies in preparing and issuint 
their rules in accordance with the requicements of the Act. 
and to achieve some degree of consistency in rules for 
similar systems. 


The OMB staff oversees agency rulemaking and the publicatior 
of notices by reviewing the Federal Register daily and 
providing comments on aqency issuances as necessary. 


REVIEW OF REPORTS ON NEW AND ALTERED SYSTEMS 


The Act states that “each agency shall provide adequate 
advance notice to Congress and the Office of Management 
and Budget of any proposal to establish or alter any 
system of records in order to permit an evaluation of the 
probable or potential effect of such proposal on the 
privacy and other personal or property rights of individ- 
uals..." 


OMB policies implementing this provision require agencies 
to submit reports on proposed new or altered systems (RONS) 
to Congress and OMB 60 days prior to the issuance of any 
data collection forms or instructions, 60 days before 
entering any personal information into the new or altered 
system, or 60 days prior to the issuance of any requests 
for proposals for computer and communications systems or 
services to support such systems, whichever is earlier. 


OMB Review of RONS 

Each RONS is reviewed by OMB to: 

° Determine whether the agency has adequately complied with 
the reporting criteria established by OMB ~- in form and 
substance. 

° Determine whether the system is consistent with agency 


mission requirements. 
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® Determine whether appropriate consideration has been 
given to personal privacy consistent with the letter, 
spirit and intent of the Act. 


After such review, any action considered necessary is 
initiated with the agency. 


Public review of RONS 


While the new system reporting requirements were established 
primarily for the purposes of cOngressional and OMB oversight 
over the development of new (or altered) systems by agencies, 
OMB has established a process to give the general public an 
opportunity to comment on the agency proposals. 


° A summary of agency proposals to establish or alter per- 
sonal data systems provided te OMB and the Congress is 
published in the Federal Register by OMB approximately 
every two weeks. 


° Copies of this public announcement are mailed directly 
to the staff of Members of Conqress who have indicated 
an interest in privacy, the trade press and a list of 
private citizens and organizations which have indicated 
an interest in privacy. About 95 copies are distributed. 


Waiver Procedures 


OMB procedures permit a waiver of the advance notice reqnui-e- 
ment when the agency can show that the delay caused by the 

60 day advance notice would not he in the public interest:. 

A waiver of the 60 day advance notice period does not relisve 
an agency of the obligation to publish-a notice describing 
the system and allow 30 days for public comment on the pro: 
posed routine uses of the personal information to be 
collected. 


CONSIDERATION OF PRIVACY IN THE BUDGET PROCESS 
Agency budget requests for information system development 
efforts, computer/telecommunication hardware procurement 
and software development activities are given special 
emphasis in the OMB budget review process. Privacy is one 
Of a number of important policy issues that are closely 
examined in this process. 


Internal OMB procedures for reviewing agency budget proposals 
establish stringent criteria for reviewing agency budget 
justifications for information processing activities. These 
procedures require a review of the agency justifications 


to ascertain that they -- 
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° "Include a clear indication of the necessity for such 
data collections and the safeguards the agency will 
employ to preclude inadvertent or surreptitious access 
by unauthorized persons to such data," and that 


° "The acquisition of data processing and telecommunica- 
tion equipment should be reviewed to assure that the 
requirements of the Privacy Aci (P.L. 93-579) have been 
met.” 


As a part of the Administration's multi-year budget 
initiative, OMB requires agencias to identify major 
computer and telecommunication svstem acquisitions in 
the current year, the budget year and each year for four 
years beyond the budget year. OMB provides this infor- 
mation to Congress in order to provide earlier opportu- 
nities for congressional review of agency Plans. The 
list of acquisitions are provided to GSA to assist them 
in carrying out their computer procurement control 
functions. This additional review provides an opportu- 
nity to evaluate the probable impact of these systems on 
personal privacy. 


‘CONSIDERATION OF PRIVACY LN THE LEGISLATIVE REVIEW PROCESS 


The legislative coordination and clearance responsibilities 
of OMB are an important corollary to OMB budget and manage- 
ment functions, since the President's program and budget 
recommendations are dependent upon legislation to carry out 
the proposals. 


The OMB legislative coordination and clearance process in- 
cludes assisting in the preparation of the President's 
legislative program, coordinating and clearing of agency 
legislative reports and draft bills, responding to requests 
of committees of the Congress for OMB reports and testify- 
ing on pending bills and handling of enrolled bills. 


The process is coordinated by a central staff in OMB whicn 
seeks the views and judgments of many people, both in OMB 
and throughout the Government, before advising the President 
through the Director. it is through this means that privac? 
is considered and balanced with other policy and budget 
considerations. 


Examples of recent bills which involved privacy questions 
are the Tax Reform Act of 1976, the Social Services Amend— 
ments, and the Right to Financial Privacy Bill. Other 
examples are agency draft bills on confidentiality of 
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longitudinal medical studies, and standards for enlist- 
ment in the Armed Forces. 


» 
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HANDLING OF PUBLIC INQUIRIES 


OMB, by virtue of its oversight responsibilities, receives 
a large volume of inquiries by telephone and mail about 
the Act. These include citizen complaints on Government 
actions, inquiries regarding rights and privileges under 
the Act, Foreign, State, and local government inquiries 

on U.S. Federal Government experience under the Act, and 

a wide range of other questions. 


Public inquiries are generally handled as follows: 


° Informational inquiries or those seeking interpretation 
of Federal policy and experience are handled directly 
by OMB. 


° Complaints about a particular agency's practices are 
usually answered by providing individuals with infor- 
mation on their rights and agency responsibilities 
under the Act and then referring the complaint to the 
responsible agency. Follow-up action with the agency 
is initiated only in those cases where the agency does 
not appear to be fulfilling its responsibilities under 
the Act. 


IMPACT ON GOVERNMENT OPERATIONS 


A number of provisions of the Act were designed to chance 
existing agency practices on the collection and disclosure 
of personal data. These changes have had an impact on the 
patterns of information exchange about individuals. Fx- 
perience to date indicates that: 


° The public is becoming more reluctant to provide personal 
data and willing to challenge Federal agency requests fer 
information. 


° Agencies are demonstrating more caution in exchanging 
personal data. 


° Some agencies are experiencing difficulty in obtaining 
personal information from third party sources. They 
indicate that less information is being provided and the 
information that is provided is less candid. 


° Inconsistencies hetween Federal, State, and local 
privacy laws have created some problems in obtaining 
personal information from academic institutions, 
lending organizations and medical facilities. 
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However, no agency has indicated that the provisions of the 
Act have made it impossible to obtain information needed to 
carry out Federal programs. 


IMPACT ON PRIVACY OF INDIVIDUALS 


While it is difficult, if not impessible, to quantify 
"privacy protection" achieved by the Act, there are a 
number of measures and subjective observations which 
suggest that the Act has had a significant impact on 
achieving a better balance between the Government's need 
for information and protecting an individuil's right to 
privacy. 


° Review of agency proposals for new and altered systems 
and public scrutiny of agency recordkeeping practices 
suggest that the majority of personal information 
collected is proper and necessary to carry out Government 
functions. 


° Agencies report that they have received very few 
questions from Congress about their proposals for new 
or altered systems and very few comments from the public 
at large on their personal recordkeeping practices as 
described in public notices. 
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®° Privacy administrators in the agencies believe that the 
privacy consciousness which has been created by the 
Act, coupled with its sanctions, has established a deter- 
rent to unnecessary or improper collection of personal 
information and has created greater sensitivity to proper 
and fair handling of such information. 


° During the first four years of the Privacy Act imple- 
mentation both the number of agency systems of personal 
records and the number of individual records have been 
significantly reduced. 


° Further statistics on the effects of the Act are contained 
in the four Annual Reports to Congress. 


In summary, OMB believes that the intended purposes of the 
Act are being achieved and that the agencies are sincerely 
working to establish and operate affective privacy protection 
programs. We draw this conclusion despite the fact that the 
effectiveness of privacy protection is nat something that is 
susceptible to quantitative measurement and proof. Nor is it 
something that is possible to achieve merely by regulatory 
fiat. Rather, it can only be brought about by instilling a 
continuing concern for privacy in the consciousness of over 
two million Federal workers, many of whom are involved daily 
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personal records. The procedures which have be 
; rds du 2 en estab- 
lished to administer the Act, along with continual OMB, 
congressional and public oversight of these activiti 
oné : ivities 
have sensitized the Federal workforce to the concerns of 


pe veey and are working to achieve the objectives of the 
ct. . 
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